claw-skill-guard

Name: claw-skill-guard
Availability: InStock
Author: dfpalhano

Scan OpenClaw skills for malicious patterns, suspicious URLs, and installation traps.

Updated Feb 26, 2026

Search Tags:#security #vulnerability assessment #code safety #threat intelligence #malware detection #skill scanning

Ready to run

npx skills add https://github.com/dfpalhano/openclaw-workspace --skill claw-skill-guard

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: claw-skill-guard
Source: https://github.com/dfpalhano/openclaw-workspace/tree/main/skills/claw-skill-guard
Command: npx skills add https://github.com/dfpalhano/openclaw-workspace --skill claw-skill-guard

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and patterns (resource) and examples (resource) components.

What problem does it solve?

This Skill addresses the critical security risk of malicious code hidden within AI agent skills, preventing the installation of malware and protecting your system from compromise.

Core Features & Use Cases

Real-time Scanning: Analyzes skills for dangerous patterns before installation.
Risk Assessment: Categorizes threats into Critical, High, Medium, and Low.
Enforcement Guidance: Provides clear instructions for integrating security checks into workflows (AGENTS.md, pre-commit hooks, CI/CD).
Use Case: Before installing a new skill from ClawHub, run claw-skill-guard scan <skill-url> to ensure it doesn't contain hidden malware or dangerous commands.

Quick Start

Scan a local skill directory named 'my-new-skill' using the command python3 skills/claw-skill-guard/scripts/scanner.py scan ./skills/my-new-skill.

Frequently Asked Questions about claw-skill-guard

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan an AI agent skill for malware before installation?▼

To scan a skill for malware, run the scanner script against the local directory, remote URL, or ClawHub slug. This identifies malicious patterns, suspicious URLs, and installation traps before the skill is installed.

What is AI agent skill vulnerability assessment and how does it work?▼

Skill vulnerability assessment detects malicious code hidden in AI agent skills by analyzing files with predefined regex patterns and an allowlist. It categorizes identified threats into critical, high, medium, and low-risk levels to ensure code safety.

Can I scan remote URLs and ClawHub skill slugs for security threats?▼

Yes, you can scan remote URLs and ClawHub skill slugs for security threats. The scanner evaluates these sources for dangerous commands and malicious patterns before you install them on your system.

How do I integrate security scanning into my CI/CD pipeline?▼

You can integrate security scanning into your CI/CD pipeline using pre-commit hooks and AGENTS.md enforcement guidance. This automates threat intelligence checks to block malware during the development workflow.

What are the limitations of regex-based malware detection for OpenClaw skills?▼

Regex-based malware detection relies on predefined patterns and an allowlist, meaning it may miss novel or obfuscated threats not yet recognized. It categorizes known suspicious URLs and installation traps but requires updated patterns for new vulnerabilities.